## Context Following a review of Slack channel discussions, several updates have been identified for the [Account Deletion & Access Request Workflows](https://handbook.gitlab.com/handbook/support/workflows/account_deletion_access_request_workflows/) handbook page. This issue tracks the full set of changes, with each update delivered as a separate MR linked to this issue. ## Updates Required ### MR 1: Strengthen subscription check ordering and add paid subscription pause logic **Status:** Already reflected / Partially reflected — needs strengthening - Add explicit guidance that before any deletion, Support must check whether a non-enterprise user has an active paid subscription. - If an active paid subscription exists, Support must: - Stop all deletions - Note the subscription end date and auto-renew state - Notify Privacy - Privacy pauses the request until the subscription ends - Add a stronger, unmistakable warning that the cDot/subscription check **must** happen before GitLab account deletion. Once the GitLab account is deleted, Privacy may no longer be able to determine whether the user was enterprise-linked or what subscription context existed. **References** 1. [Critical update](https://gitlab.enterprise.slack.com/archives/C09CA9E3069/p1775509372863079?thread_ts=1775509372.863079&cid=C09CA9E3069) 2. [active Premium subscription but GitLab account already deleted](https://gitlab.enterprise.slack.com/archives/C09CA9E3069/p1781251690186959?thread_ts=1781251690.186959&cid=C09CA9E3069) 3. [deleting GitLab before checking cDot causes bad outcomes](https://gitlab.enterprise.slack.com/archives/C09CA9E3069/p1781615896694389?thread_ts=1781354748.247979&cid=C09CA9E3069) ### MR 2: Add explicit close/cancel step for duplicate requests MR: https://gitlab.com/gitlab-com/content-sites/handbook/-/merge_requests/20214+ **Status:** Missing / under-specified - The page currently says to send the Duplicate Request message, but this does not close the workflow automatically. - Add an explicit step: after sending the duplicate request email, the request must still be canceled/closed explicitly. **References** - [Chris asks what happens after sending the duplicate email](https://gitlab.enterprise.slack.com/archives/C09CA9E3069/p1777602052885149?thread_ts=1777602052.885149&cid=C09CA9E3069) - [Stephanie says she canceled it and the workflow should include that](https://gitlab.enterprise.slack.com/archives/C09CA9E3069/p1777639890712939?thread_ts=1777602052.885149&cid=C09CA9E3069) ### MR 3: Add enterprise-user waiting-period operator guidance **Status:** Missing / under-specified - While waiting out the 7-day enterprise-user period, Support should leave the request open. - Transcend does not show when that period ends, so add guidance to note the 7-day end date in the task. **References** - [Michael asks whether to mark exception or leave it open](https://gitlab.enterprise.slack.com/archives/C09CA9E3069/p1781200955158799?thread_ts=1781200955.158799&cid=C09CA9E3069) - [Stephanie says leave it open and note the 7-day end date](https://gitlab.enterprise.slack.com/archives/C09CA9E3069/p1781204744322239?thread_ts=1781200955.158799&cid=C09CA9E3069) ### MR 4: Update "deletion complete" wording **Status:** Clarification needed in workflow and/or linked messaging MR: https://gitlab.com/gitlab-com/content-sites/handbook/-/merge_requests/20150+ - The communication to the data subject should be accurate and not imply the account is already fully gone if backend cleanup is still pending. - Update wording so Support can complete the integration step after the workflow step is done, without falsely telling the user their account is already fully deleted. **References** - [Bronwyn outlines the two options and says user comms should be accurate](https://gitlab.enterprise.slack.com/archives/C09CA9E3069/p1779455937831439?thread_ts=1779373513.909819&cid=C09CA9E3069) - [Bronwyn agrees to update the email wording](https://gitlab.enterprise.slack.com/archives/C09CA9E3069/p1779456490585919?thread_ts=1779373513.909819&cid=C09CA9E3069) md ## Checklist - [ ] MR 1: Strengthen subscription check ordering and add paid subscription pause logic - [x] MR 2: Add explicit close/cancel step for duplicate requests - [ ] MR 3: Add enterprise-user waiting-period operator guidance - [ ] MR 4: Update "deletion complete" wording - [ ] Final review: Read through the full page end-to-end for consistency after all MRs are merged